# Env vars

Env vars are the settings an app gets, like `DATABASE_URL`. dudbox keeps them encrypted. A secret value is write-only: the app gets it, but no answer shows it again (`value` is `null`), and build logs mask it. The one exception is a one-click app's login password (`login.password_env` on the service), which you type into the app.

The app gets a change on its next deploy: after you set or delete env vars, call `POST .../redeploy` once (see [Deployments](/docs/api/deployments.md)).

The examples use `API=https://dudbox.com/api/v1` and `AUTH="Authorization: Bearer $DUDBOX_TOKEN"`.

### `GET /api/v1/services/{project}/{service}/env`

All env vars of a service. Secret values are `null` here.

```json
{
  "env": [
    { "key": "LOG_LEVEL", "value": "info", "secret": false },
    { "key": "DATABASE_URL", "value": null, "secret": true }
  ]
}
```

### `GET /api/v1/services/{project}/{service}/env/{key}`

One env var. A secret value is `null`, except a one-click app's login password: dudbox logs each read of that, with the token that read it.

```sh
curl -s $API/services/acme/shop/env/LOG_LEVEL -H "$AUTH"
```

```json
{ "key": "LOG_LEVEL", "value": "info", "secret": false }
```

### `PUT /api/v1/services/{project}/{service}/env/{key}`

Makes or changes an env var. `secret` is `false` if you leave it out. A name has letters, digits and `_`, and does not start with a digit. A value is at most 32 KB.

```sh
curl -s -X PUT $API/services/acme/shop/env/DATABASE_URL -H "$AUTH" -H 'content-type: application/json' \
  -d '{"value": "postgres://…", "secret": true}'
```

Answer: `200` with the env var (`value` is `null` for a secret).

### `POST /api/v1/services/{project}/{service}/connect`

Gives a database to an app: sets the database's connect URL (`DATABASE_URL` or `REDIS_URL`), with its password, on an app in the same project, as a secret. `{service}` is the database. The password never leaves dudbox. The app gets the URL on its next deploy: call `POST .../redeploy` on the app.

```sh
curl -s -X POST $API/services/acme/postgres/connect -H "$AUTH" -H 'content-type: application/json' \
  -d '{"app": "shop"}'
```

```json
{ "key": "DATABASE_URL", "value": null, "secret": true }
```

A `{service}` that is not a database gets `400`. An app that is not in the project gets `404`.

### `DELETE /api/v1/services/{project}/{service}/env/{key}`

Deletes an env var. Answer: `204`, no body. A name that is not there gets `404`.